summaryrefslogtreecommitdiffstats
path: root/src/providers/ipa
Commit message (Collapse)AuthorAgeFilesLines
* LDAP: Add the wildcard_limit optionJakub Hrozek2015-07-151-0/+1
| | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Adds a new wildcard_limit option that is set by default to 1000 (one page). This option limits the number of entries that can by default be returned by a wildcard search. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* KRB5: Add and use krb5_auth_queue_send to queue requests by defaultJakub Hrozek2015-07-061-6/+6
| | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2701 Previously, only the krb5 provides used to queue requests, which resulted in concurrent authentication requests stepping on one another. This patch queues requests by default. Reviewed-by: Sumit Bose <sbose@redhat.com>
* views: Add is_default_view helper functionMichal Židek2015-07-024-20/+10
| | | | | | | Ticket: https://fedorahosted.org/sssd/ticket/2641 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP/IPA: add user lookup by certificateSumit Bose2015-06-191-0/+14
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: add ldap_user_certificate optionSumit Bose2015-06-191-0/+1
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Store keytabs in /var/lib/sss/keytabsJakub Hrozek2015-06-161-1/+1
| | | | | | Make sure the directory is only accessible to the sssd user Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: Utility function for setting up one-way trust contextJakub Hrozek2015-06-141-4/+67
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Do not set AD_KRB5_REALM twiceJakub Hrozek2015-06-141-8/+0
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Both the AD common code and ipa_ad_ctx_new() used set AD_KRB5_REALM. As verified by unit tests, we don't need to set the parameter twice. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA/AD: Set up AD domain in ad_create_2way_trust_optionsJakub Hrozek2015-06-141-10/+5
| | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Removed code duplication. Amends unit test to make sure we don't regress. Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: Rename ad_create_default_options to ad_create_2way_trust_optionsJakub Hrozek2015-06-141-2/+2
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2638 Better reflects what's going on in the function. Also adds a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Fetch keytab for 1way trustsJakub Hrozek2015-06-142-21/+409
| | | | | | | | | Uses the ipa-getkeytab call to retrieve keytabs for one-way trust relationships. https://fedorahosted.org/sssd/ticket/2636 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Make constructing an IPA server mode context asyncJakub Hrozek2015-06-143-30/+249
| | | | | | | Refactoring in preparation for requesting the keytab in future patches. Currently it's a fake async that just marks the request as done. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Read forest name for trusted forest roots as wellJakub Hrozek2015-06-141-0/+15
| | | | | | | | | This will reduce special-casing when establishing forest roots as all domains will contain the forest name. Additionally, AD subdomains already contain the forest name. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Include ipaNTTrustDirection in the attribute set for trusted domainsJakub Hrozek2015-06-143-21/+140
| | | | | | | | | | | Allows to distinguish the trust directions for trusted domains. For domains where we don't know the direction in server mode, we assume two-way trusts. Member domains do not have the direction, but rather the forest root direction is used. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Split two functions to new module ipa_subdomains_utils.cJakub Hrozek2015-06-143-42/+111
| | | | | | | | | These functions will be later reused by the subdomains_server.c module. Splitting them into a separate subdomains_utils.c module will make sure there are no cyclic dependencies and the functions are testable in isolation. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Move server-mode functions to a separate moduleJakub Hrozek2015-06-144-317/+357
| | | | | | | | There is already quite a few functions that are server-mode specific and there will be even more with one-way trusts. Split the server-mode specific functions into a separate module. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Also update master domain when initializing subdom handlerJakub Hrozek2015-06-141-0/+9
| | | | | | | Updating master domain record from sysdb will ensure the flat name of the master domain record is up-to-date. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Fold ipa_subdom_enumerates into ipa_subdom_storeJakub Hrozek2015-06-141-15/+10
| | | | | | Reduced code duplication Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Check master domain record before subdomain recordsJakub Hrozek2015-06-141-14/+28
| | | | | | | | | | | | | | | | | | | | For one-way trusts we need to know the flat name of the IPA domain when we process subdomains, hence we need to swap the processing order and read the master domain record sooner. Previsouly the order was: - ranges - subdomains - if on client, views - master Now the order is: - ranges - master - subdomains - if on client, views Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Add ipa_subdomains_handler_get_{start,cont} wrappersJakub Hrozek2015-06-141-13/+34
| | | | | | | | | | Previously it was error-prone to move code around, because the functions that started next subdomain request were scattered together with moving to next base or assigning next base. This patch creates a wrappers for better readability. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add realm to sysdb_master_domain_add_infoJakub Hrozek2015-06-141-1/+10
| | | | | | | | | | Adding realm to both master domain and subdomain will make it easier to set and select forest roots. Even master domains can be forest members, it's preferable to avoid special-casing as much as possible. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Store trust direction for subdomainsJakub Hrozek2015-06-141-1/+1
| | | | | | | | | | | | We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Don't override homedir with subdomain_homedirPavel Reichl2015-06-141-7/+23
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2583 Reviewed-by: Michal Židek <mzidek@redhat.com>
* subdomains: Inherit cleanup period and tokengroup settings from parent domainJakub Hrozek2015-06-051-0/+4
| | | | | | | | | | | Allows the administrator to extend the functionality of ldap_purge_cache_timeout, ldap_user_principal and ldap_use_tokengroups to the subdomains. This is a less intrusive way of achieving: https://fedorahosted.org/sssd/ticket/2627 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* dyndns: ipa_dyndns.h missed declaration of used dataPavel Reichl2015-06-051-0/+4
| | | | | | ipa_dyndns.h was depended on header files included before it. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: remove dupl declaration of ipa_dyndns_updatePavel Reichl2015-06-021-3/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Skip enumeration requests in IPA and AD providers as wellJakub Hrozek2015-06-011-0/+5
| | | | | | | | | | | | | | Checking the enum request in the underlying LDAP provider to skip it might be too late as the richer IPA or AD providers depend on having a useful result when the sdap request finishes. Move the enumeration check earlier instead and allow directly in the IPA or AD handler. Related: https://fedorahosted.org/sssd/ticket/2659 Reviewed-by: Sumit Bose <sbose@redhat.com>
* krb5: new option krb5_map_userPavel Reichl2015-05-281-0/+1
| | | | | | | | | | New option `krb5_map_user` providing mapping of ID provider names to Kerberos principals. Resolves: https://fedorahosted.org/sssd/ticket/2509 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: disable the cleanup task by defaultJakub Hrozek2015-05-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2627 The cleanup task was designed to keep the cache size within certain limits. This is how it roughly works now: - find users who have never logged in by default. If account_cache_expiration is set, find users who loggged in later than account_cache_expiration - delete the matching set of users - find groups that have no members - delete the matching set of groups So unless account_cache_expiration is set to something sensible, only empty groups and expired users who never logged in are removed and that's quite a corner case. The above effectivelly walks the whole database, especially the groups step is quite slow with a huge database. The whole cleanup task also runs in a single sysdb transaction, which means all other transactions are blocked while the cleanup task crunches the database. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: do not fail if view name lookup failed on older versionsSumit Bose2015-05-121-1/+8
| | | | | | | | | | | | | | Depending on the version 389ds return a different error code if the search for the view name failed because our dereference attribute ipaAssignedIDView is not known. Newer version return LDAP_UNAVAILABLE_CRITICAL_EXTENSION(12) which is translated to EOPNOTSUPP and older versions return LDAP_PROTOCOL_ERROR(2) which is returned as EIO. In both cases we have to assume that the server is not view aware and keep the view name unset. Resolves https://fedorahosted.org/sssd/ticket/2650 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: create preauth indicator file at startupSumit Bose2015-05-081-0/+66
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add pre-auth requestSumit Bose2015-05-081-0/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: allow initgroups by UUID for FreeIPA usersSumit Bose2015-05-061-1/+14
| | | | | | | | | | | If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: do not add domain name unconditionallySumit Bose2015-05-061-0/+2
| | | | | | | | | | | Depending on the server-side configuration the extdom plugin can return short or fully qualified names for IPA objects. The client must handle the names according to its own configuration and not add the domain part of the fully-qualified name unconditionally. Resolves https://fedorahosted.org/sssd/ticket/2647 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: search for overrides during initgroups in sever modeSumit Bose2015-05-051-0/+69
| | | | | | | | | | After the group memberships of a user from a trusted domain are read it must be checked if there are overrides for the discovered groups to be able to return the right gid or name to the caller. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: enhance ipa_initgr_get_overrides_send()Sumit Bose2015-05-052-17/+56
| | | | | | | | | This patch makes ipa_initgr_get_overrides_send() public and add support to search overrides by UUID or by SID. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: update initgr expire timestamp conditionallySumit Bose2015-05-051-8/+11
| | | | | | | | | | | | | | | Newer versions of the extdom plugin return the full list of group-memberships during user lookups. As a result the lifetime of the group-membership data is updates in those cases. But if the user is not looked up directly but is resolved as a group member during a group lookup SSSD does not resolve all group-membership of the user to avoid deep recursion and eventually a complete enumeration of the user and group base. In this case the lifetime of the group-memberships should not be updated because it might be incomplete. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: do initgroups if extdom exop supports itSumit Bose2015-05-053-10/+21
| | | | | | | | | | | | | | Newer versions of the extdom plugin return the full list of group-memberships during a user lookup request. With these version there is no need to reject a initgroups request for sub/trusted-domain users anymore. This is e.g. useful for callers which call getgrouplist() directly without calling getpwnam() before. Additionally it helps if for some reasons the lifetime of the user entry and the lifetime of the initgroups data is different. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: fix segfault in ipa_s2n_exopAron Parsons2015-04-291-1/+1
| | | | | | | | can be triggered on demand by assigning a POSIX group with external members sudo privileges, then dropping the cache and doing a sudo -U <user> -l. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: allow initgroups by SID for AD usersSumit Bose2015-04-291-0/+13
| | | | | | | | | | | If a user from a trusted AD domain is search with the help of an override name the SID from the override anchor is used to search the user in AD. Currently the initgroups request only allows searches by name. With this patch a SID can be used as well. Resolves https://fedorahosted.org/sssd/ticket/2632 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: check ghosts in groups found by uuid as wellSumit Bose2015-04-271-9/+12
| | | | | | | | | | | | With views and overrides groups are not allowed to have ghost members anymore because the name of a member might be overridden. To achieve this ghost members are looked up and resolved later during group lookups. Currently this is only done for group lookups by name but should happen as well if the group is looked up by uuid. Resolves https://fedorahosted.org/sssd/ticket/2631 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: use sysdb_attrs_add_string_safe to add group memberSumit Bose2015-04-271-2/+3
| | | | | | | | The member list returned by the extdom plugin might contain some entries more than once. Although this is an issue on the server side to avoid ldb errors duplicates should be filtered out on the client as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: do not try to save override data for the default viewSumit Bose2015-04-271-5/+10
| | | | | | | | | | For the default view all override data is available in the cached user or group object. Even if separate override data is available it should not be written into the cache. Resolves https://fedorahosted.org/sssd/ticket/2630 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* subdom: Remove unused function get_flat_name_from_subdomain_nameJakub Hrozek2015-04-162-24/+0
| | | | | | | The function was added in 70eaade10feedd7845e39170d0b7eebf3a030af1 and is unused since b8d703cf3aba81800cf1b8ccca64bb00ef0b30f7 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* selinux: Only call semanage if the context actually changesJakub Hrozek2015-04-141-4/+31
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2624 Add a function to query the libsemanage database for a user context and only update the database if the context differes from the one set on the server. Adds talloc dependency to libsss_semanage. Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: Remove the ipa_hbac_treat_deny_as optionJakub Hrozek2015-03-248-79/+19
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 Since deny rules are no longer supported on the server, the client should no longer support them either. Remove the option. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Deprecate the ipa_hbac_treat_deny_as optionJakub Hrozek2015-03-241-0/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 Deny rules have not been supported by the IPA server since 2.1. We should deprecate the ipa_hbac_treat_deny_as option. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Only treat malformed HBAC rules as fatal if deny rules are enabledJakub Hrozek2015-03-241-14/+54
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 If deny rules are not in effect, we can skip malformed HBAC rules because at worst we will deny access. If deny rules are in effect, we need to error out to be on the safe side and avoid skipping a deny rule. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Drop useless sysdb parameterJakub Hrozek2015-03-241-16/+10
| | | | | | | | https://fedorahosted.org/sssd/ticket/2603 It's better to dereference the domain structure. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Use custom error codes when validating HBAC rulesJakub Hrozek2015-03-244-29/+29
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2603 Instead of reusing EINVAL/ENOENT, use more descriptive error codes. This will be useful in the next patch where we act on certain codes. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-23 17:52:21 +0000